Find Attack discoveries that match the search criteria
https://{kibana_url}
- GET /api/attack_discovery/_find
Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.
Query Parameters
-
alert_idsstring Filter results to Attack discoveries that include any of the provided alert IDs
-
connector_namesstring Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable
connector_nameproperty of an Attack discovery, e.g. "GPT-5 Chat", which are distinct fromconnector_idvalues used to generate Attack discoveries.-
enable_field_renderingboolean · default: false Enables a markdown syntax used to render pivot fields, for example
{{ user.name james }}. When disabled, the same example would be rendered asjames. This is primarily used for Attack Discovery views within Kibana. Defaults tofalse.-
endstring End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
-
idsstring Filter results to the Attack discoveries with the specified IDs
-
include_unique_alert_idsboolean If
true, the response will includeunique_alert_idsandunique_alert_ids_countaggregated across the matched Attack discoveries-
pageinteger · min: 1 · default: 1 Page number to return (used for pagination). Defaults to 1.
-
per_pageinteger · min: 1 · default: 10 Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
-
searchstring Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use
trueto return only shared discoveries,falseto return only those visible to the current user. Mutually exclusive withinclude_all_authors.If
true, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive withshared.-
scheduledboolean Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use
trueto return only scheduled discoveries orfalseto return only ad-hoc discoveries.-
sort_field Field used to sort results. See
AttackDiscoveryFindSortFieldfor allowed values.-
Values:
@timestamp -
sort_order Sort order direction
ascfor ascending ordescfor descending. Defaults todesc.-
Values:
ascdesc -
startstring Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
-
status Filter by alert workflow status. Provide one or more of the allowed workflow states.
-
Values:
acknowledgedclosedopen -
with_replacementsboolean · default: true When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to
true.
Responses
Indicates a successful call.
-
connector_namesstringrequired -
List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
-
dataobjectrequired -
Array of matched Attack discovery objects. Each item follows the
AttackDiscoveryApiAlertschema. -
alert_idsstringrequired -
The alert IDs that the attack discovery is based on
-
alert_rule_uuidstring -
The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
-
alert_startstring -
The optional time the attack discovery alert was created
-
alert_updated_atstring -
The optional time the attack discovery alert was last updated
-
alert_updated_by_user_idstring -
The optional id of the user who last updated the attack discovery alert
-
alert_updated_by_user_namestring -
The optional username of the user who updated the attack discovery alert
-
alert_workflow_reasonstring -
The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed
-
alert_workflow_statusstring -
The optional kibana.alert.workflow_status of this attack discovery
-
alert_workflow_status_updated_atstring -
The optional time the attack discovery alert workflow status was last updated
-
assigneesstring -
The optional array of user-IDs who have been assigned the attack
-
connector_idstringrequired -
The ID of the connector that generated the attack discovery
-
connector_namestringrequired -
The (human readable) name of the connector that generated the attack discovery
-
details_markdownstringrequired -
Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
-
entity_summary_markdownstring -
An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax
-
generation_uuidstringrequired -
The generation ID of the run that created the attack discovery
-
idstringrequired -
The unique ID of the attack discovery
-
indexstring -
The concrete Elasticsearch index where this attack discovery is stored
-
mitre_attack_tacticsstring -
An optional array of MITRE ATT&CK tactic for the attack discovery
-
replacementsobject -
Replacements object used to anonymize/deanonymize messages
-
risk_scoreinteger -
The optional, (but typically populated after generation) risk score of the alert
-
summary_markdownstringrequired -
A markdown summary of attack discovery, using the same syntax
-
The optional array of tags assigned the attack
-
timestampstring · min: 1required -
A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
-
titlestringrequired -
A title for the attack discovery, in plain text
-
user_idstring -
The optional id of the user who generated the attack discovery
-
user_namestring -
The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)
-
pageintegerrequired -
Current page number of the paginated result set.
-
per_pageintegerrequired -
Number of items requested per page.
-
totalintegerrequired -
Total number of Attack discoveries matching the query (across all pages).
-
unique_alert_idsstring -
List of unique alert IDs aggregated from the matched Attack discoveries. Only present if
include_unique_alert_ids=truein the request. -
unique_alert_ids_countintegerrequired -
Number of unique alert IDs across all matched Attack discoveries. Only present if
include_unique_alert_ids=truein the request.
Bad Request response.
-
errorstring -
Error type
-
messagestring -
Human-readable error message
-
status_codenumber -
HTTP status code